Install the Splunk Common Information Model Add-on

1. Download the Common Information Model add-on from Splunkbase at https://apps.splunk.com/app/1621/.
2. Review the indexes defined in CIM.
   1. The cim_summary index definition is deprecated, but is included for backwards compatibility with upgraded versions of Splunk Enterprise Security and the Splunk App for PCI Compliance.
   2. The cim_modactions index definition is used with the common action model alerts and auditing. Assign the appropriate Roles to search the index.
3. Install the Splunk Common Information Model Add-on to your search heads only. Installing this add-on to indexers results in redundant data model acceleration overhead if acceleration is enabled.
   Refer to Installing add-ons for detailed instructions describing how to install a Splunk add-on in the following deployment scenarios:

• Single-instance Splunk Enterprise
• Distributed Splunk Enterprise
• Splunk Cloud
• Splunk Light

Next: See Set up the Splunk Common Information Model Add-on to perform optional configurations to improve performance.